wtclaude
be44839896
The org lead's rule, settled 2026-09-22: who is online is always the
narrowest audience - staff - unless an operator deliberately widens it,
and a count is fine where a list of names is not.
The public site broke that in three places since phase 4. The Online
tab named every player, the feed carried joins, respawns, deaths, chat
and tallies, and the leaderboard's lastSeen - refreshed every minute by
a gather tally - said who was on as plainly as either. All three now
sit behind one setting:
* PRESENCE_KINDS, a subset of the public allowlist, gated per request.
Below the audience the feed keeps the server's own story (wipe, start,
shutdown) and says presenceHidden rather than looking quiet.
* the Online route answers { players: [], hidden, count, audience } -
same shape, so an older client renders empty rather than breaking.
* rungs staff / signed_in / public, fleet-wide default in a new
rust_settings table with an optional per-server override on
rust_servers; an unknown stored word narrows to staff.
* the viewer's standing is RE-READ from the users row (ctx.users.getById),
not taken from the token, so a demotion or a ban applies on the next
request. Walked: a moderator demoted mid-session lost the roll call on
the same cookie.
* per-viewer answers are Cache-Control: private, no-store.
* GET/PUT /admin/rust/visibility (requireRole admin) and an admin page,
Rust visibility; every save is one activity-log row.
The browser walk also found every empty state in this module rendering
as a blank box. Core's EmptyState renders children only; this module
passed title/message (the shape the Integration Kit template teaches)
and React dropped both without a word. Fixed module-side with a small
Empty wrapper - nothing core or module-uo renders changes - and a client
test that refuses a titled EmptyState or a PageHeader subtitle.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
118 lines
7.8 KiB
JavaScript
118 lines
7.8 KiB
JavaScript
// ── Public · Rust ─────────────────────────────────────────────────────────
|
||
//
|
||
// Mounted at `/api/v1/public/rust` by `index.js`. One express Router, built from
|
||
// CORE's express (`core.express`) — never from a `require('express')` of your
|
||
// own, which would not resolve from here anyway (MODULE_API.md §7.2).
|
||
//
|
||
// **The tier's gate is already on.** This router sits inside core's public tier,
|
||
// which is behind nothing by design. Per-route middleware goes on top, and
|
||
// `siteMode` is the one worth understanding: it is what makes a route respect the
|
||
// operator's maintenance switch. Core applies it to its own content routes and
|
||
// deliberately does not apply it to its status endpoints, because status is
|
||
// exactly what an operator wants visible *during* maintenance.
|
||
//
|
||
// The server list is content, not status — it is the module's landing page — so
|
||
// it takes `siteMode`.
|
||
//
|
||
// ── About the `#swagger` comments ─────────────────────────────────────────
|
||
//
|
||
// They are not documentation *of* the code; they are the source the OpenAPI
|
||
// fragment is generated from (`npm run swagger`, §2.8). swagger-autogen reads
|
||
// them as JavaScript literals it evaluates, so a QUOTE CHARACTER inside a
|
||
// single-quoted description ends the string early — and the failure is silent:
|
||
// the value is truncated at that character while the generator prints success.
|
||
// Use a typographic apostrophe (’) in prose. A backtick is fine.
|
||
|
||
const core = require('../../core')
|
||
|
||
const express = core.express
|
||
const servers = require('./rust.controller')
|
||
const { siteMode } = core.middleware
|
||
|
||
const rustRouter = express.Router()
|
||
|
||
rustRouter.get(
|
||
'/servers',
|
||
// #swagger.tags = ['Public · Rust']
|
||
// #swagger.summary = 'Every Rust server this site follows'
|
||
// #swagger.description = 'The operator’s configured Rust servers and what each one last reported. Answers with `online: false` and `stale: true` rather than failing when a game server or its sidecar is unreachable — the site’s availability does not depend on the game’s.'
|
||
/* #swagger.responses[200] = { description: 'The server list', content: { "application/json": { schema: { $ref: "#/components/schemas/RustServerList" } } } } */
|
||
siteMode,
|
||
servers.listServers,
|
||
)
|
||
|
||
// ── One server's read path ────────────────────────────────────────────────
|
||
//
|
||
// Every route below is public, and every one of them answers from this module's
|
||
// own tables — never from a live call to a sidecar. That is what lets the
|
||
// killfeed and the leaderboard render while every game server in the fleet is
|
||
// off, which is the same promise the server list makes.
|
||
//
|
||
// **The events route serves an ALLOWLIST, default-deny** (`catalogue.js`).
|
||
// Protocol 2 carries IP addresses and player reports; they are stored, and they
|
||
// do not come out here.
|
||
|
||
rustRouter.get(
|
||
'/servers/:id',
|
||
// #swagger.tags = ['Public · Rust']
|
||
// #swagger.summary = 'One Rust server'
|
||
// #swagger.description = 'The same shape the list answers with, for one server, and a `404` when there is no such server or an operator has disabled it. The detail page needs the difference: every other route under this path answers an empty list for an id that does not exist, because an unknown server genuinely has no events and nobody online.'
|
||
// #swagger.parameters['id'] = { in: 'path', required: true, description: 'The server’s slug', schema: { type: 'string' } }
|
||
/* #swagger.responses[200] = { description: 'The server' } */
|
||
/* #swagger.responses[404] = { description: 'No such server, or it is disabled' } */
|
||
siteMode,
|
||
servers.getServer,
|
||
)
|
||
|
||
rustRouter.get(
|
||
'/servers/:id/events',
|
||
// #swagger.tags = ['Public · Rust']
|
||
// #swagger.summary = 'Recent events on one Rust server'
|
||
// #swagger.description = 'The killfeed and everything else public that happened on a server, newest first. Narrow with `kind` (comma-separated) and `wipe`. Only publicly classified kinds are ever returned — moderation events, login attempts and anything carrying an IP address are stored but never served here. Kinds that name a player who was on the server (connects, respawns, deaths, chat, tallies) are served only to viewers inside the operator’s presence audience, which defaults to staff; `presenceHidden` says when they were withheld.'
|
||
// #swagger.parameters['id'] = { in: 'path', required: true, description: 'The server’s slug', schema: { type: 'string' } }
|
||
// #swagger.parameters['kind'] = { in: 'query', required: false, description: 'One kind, or several comma-separated', schema: { type: 'string' } }
|
||
// #swagger.parameters['wipe'] = { in: 'query', required: false, description: 'Restrict to one wipe id', schema: { type: 'string' } }
|
||
// #swagger.parameters['limit'] = { in: 'query', required: false, description: 'Rows to return, capped at 200', schema: { type: 'integer' } }
|
||
/* #swagger.responses[200] = { description: 'Recent events, newest first' } */
|
||
siteMode,
|
||
servers.listEvents,
|
||
)
|
||
|
||
rustRouter.get(
|
||
'/servers/:id/leaderboard',
|
||
// #swagger.tags = ['Public · Rust']
|
||
// #swagger.summary = 'The leaderboard for one Rust server'
|
||
// #swagger.description = 'Per-wipe when `wipe` is given, all-time otherwise. All-time is the per-wipe rows summed rather than a second set of counters, so a wipe splits a player’s history without ending it. `lastSeen` is withheld below the operator’s presence audience: a gather tally refreshes it every minute a player is on, so it would name who is online.'
|
||
// #swagger.parameters['id'] = { in: 'path', required: true, description: 'The server’s slug', schema: { type: 'string' } }
|
||
// #swagger.parameters['wipe'] = { in: 'query', required: false, description: 'Restrict to one wipe id', schema: { type: 'string' } }
|
||
// #swagger.parameters['sort'] = { in: 'query', required: false, description: 'kills, deaths, npcKills or playtime', schema: { type: 'string' } }
|
||
// #swagger.parameters['limit'] = { in: 'query', required: false, description: 'Rows to return, capped at 200', schema: { type: 'integer' } }
|
||
/* #swagger.responses[200] = { description: 'The leaderboard' } */
|
||
siteMode,
|
||
servers.listLeaderboard,
|
||
)
|
||
|
||
rustRouter.get(
|
||
'/servers/:id/wipes',
|
||
// #swagger.tags = ['Public · Rust']
|
||
// #swagger.summary = 'Every wipe this server has had'
|
||
// #swagger.description = 'Newest first. A wipe id is derived by the bridge plugin from the save’s creation time and stamped on every frame, so it is the same id the events and the leaderboard are filtered by.'
|
||
// #swagger.parameters['id'] = { in: 'path', required: true, description: 'The server’s slug', schema: { type: 'string' } }
|
||
/* #swagger.responses[200] = { description: 'The wipes' } */
|
||
siteMode,
|
||
servers.listWipes,
|
||
)
|
||
|
||
rustRouter.get(
|
||
'/servers/:id/online',
|
||
// #swagger.tags = ['Public · Rust']
|
||
// #swagger.summary = 'Who is on one Rust server right now'
|
||
// #swagger.description = 'Read from the presence board the bridge re-sends on every connect and every minute, rather than counted from connect and disconnect events — so it is correct even after the website has missed one. **Nothing names who is online by default**: below the operator’s presence audience (staff unless widened) the names are withheld and only `count` is answered.'
|
||
// #swagger.parameters['id'] = { in: 'path', required: true, description: 'The server’s slug', schema: { type: 'string' } }
|
||
/* #swagger.responses[200] = { description: 'Who is online — or, below the operator’s presence audience, only how many', content: { "application/json": { schema: { $ref: "#/components/schemas/RustOnline" } } } } */
|
||
siteMode,
|
||
servers.listOnline,
|
||
)
|
||
|
||
module.exports = rustRouter
|